Skip to content

WordPress XML-RPC (xmlrpc.php) is enabled and reachable

XML-RPC is an older WordPress feature, reachable at /xmlrpc.php, originally built to let external apps and services interact with a WordPress site remotely. This check only runs when WordPress is detected, and looks at whether this endpoint responds publicly. On this site, the XML-RPC endpoint responds and is reachable. XML-RPC is a well-known attack surface. Its system.multicall method lets an attacker try hundreds of username and password combinations in a single request, making brute-force attacks far faster than trying one login at a time through the normal login page, and its pingback method is separately abused to relay distributed denial-of-service (DDoS) attacks through the site. Almost no modern WordPress site actually needs this feature enabled. Your developer should disable XML-RPC entirely unless a specific integration genuinely requires it, which is rare. This can be done at the web server level or through a security plugin like Wordfence or iThemes Security. If the site uses Jetpack or the WordPress mobile app, which do rely on XML-RPC, allowlist only the specific methods those tools actually need rather than leaving the whole endpoint open. About 30 minutes.

Why this matters

XML-RPC is a well-known attack surface. Its system.multicall method lets an attacker try hundreds of username and password combinations in a single request, making brute-force attacks far faster than trying one login at a time through the normal login page, and its pingback method is separately abused to relay distributed denial-of-service (DDoS) attacks through the site. Almost no modern WordPress site actually needs this feature enabled.

How to fix it

Your developer should disable XML-RPC entirely unless a specific integration genuinely requires it, which is rare. This can be done at the web server level or through a security plugin like Wordfence or iThemes Security. If the site uses Jetpack or the WordPress mobile app, which do rely on XML-RPC, allowlist only the specific methods those tools actually need rather than leaving the whole endpoint open. About 30 minutes.